<?php

require_once "AlertSeverity.php";

/**
 * @author bedirhan
 */
class Anonymizer {

    private static $MAX_MSG_LENGTH = 70;

    // rows are associative arrays of msal lines
    public static function anonymize(&$rows){
        // AuditLogID, SourceIP, AuditLogTime from auditlog table
        // Severity, Msg, RuleID from alerts table
        for($i=0; $i < count($rows); $i++){

            // anonymize the IP
            // don't do the following!
            //$arow = $rows[$i];
            $lastIndexOfDot = strrpos($rows[$i]['SourceIP'], ".");
            $rows[$i]['SourceIP'] = substr($rows[$i]['SourceIP'], 0, $lastIndexOfDot) . ".*" ;

            // set the severity
            $rows[$i]['Severity'] = self::getSeverity($rows[$i]['Severity']);

            // cut the message to 80 chars
            $rows[$i]['Msg'] = substr($rows[$i]['Msg'], 0, self::$MAX_MSG_LENGTH);
        }
    }

    private static function getSeverity($severity){
            switch($severity){
                case AlertSeverity::EMERGENCY:
                  return "EMERGENCY";
                  break;
                case AlertSeverity::ALERT:
                  return "ALERT";
                  break;
                case AlertSeverity::CRITICAL:
                  return "CRITICAL";
                  break;
                case AlertSeverity::WARNING:
                  return "WARNING";
                  break;
                case AlertSeverity::NOTICE:
                  return "NOTICE";
                  break;
                case AlertSeverity::INFO:
                  return "INFO";
                  break;
                case AlertSeverity::DEBUG:
                  return "DEBUG";
                  break;
                default:
                  return "UNDEFINED";
                  break;
            }
    }

}
?>
